A data transaction risk real-time management and control method and system
By using a clustering method that generates amplified features, the problem of fixed rules in data transactions being unable to adapt to changing attacks is solved, enabling adaptive risk management without human experience and improving the accuracy and flexibility of detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GANSU INST OF POLITICAL SCI & LAW
- Filing Date
- 2026-04-29
- Publication Date
- 2026-07-21
AI Technical Summary
In existing data trading scenarios, risk control methods based on fixed rules are difficult to cover constantly changing attack patterns, require a lot of human experience, and have high maintenance costs.
An amplified feature is generated based on normal historical transaction characteristics and their random perturbations. Normal clusters are formed through clustering, and anomaly determination is made by using the distance between the clusters and the transaction features to be detected. The clustering parameters are adaptively adjusted to adapt to dynamic attacks.
It reduces reliance on human experience, lowers rule base maintenance costs, and can continuously adapt to changing attack patterns, improving the accuracy and flexibility of anomaly detection.
Smart Images
Figure CN122434535A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data transaction technology, and more specifically, to a method and system for real-time risk management in data transactions. Background Technology
[0002] In data trading scenarios, it is necessary to monitor users' transaction behavior in real time and identify and intercept abnormal transactions. Currently, risk control methods based on fixed rules are commonly used, such as setting request frequency thresholds and amount limits. However, maintaining the rule base requires a lot of human experience and is difficult to cover constantly changing attack patterns. Therefore, there is an urgent need for a data trading risk management method that does not rely on manual rules. Summary of the Invention
[0003] The purpose of this invention is to provide a method and system for real-time risk management of data transactions, so as to improve the above-mentioned problems.
[0004] To achieve the above objectives, this application provides the following technical solution: On the one hand, embodiments of this application provide a method for real-time risk management and control of data transactions, the method comprising: Obtain transaction information of the target transaction object within a preset time period. The transaction information includes multiple sub-information. The transaction features to be detected are generated based on the sub-information, and the historical transaction features marked as normal are obtained; random perturbation is applied to each historical transaction feature to generate the amplified feature corresponding to each historical transaction feature; Normal core features are generated based on all historical transaction features and their corresponding amplified features. Based on the normal core features and the transaction features to be detected, it is determined whether there is any risk in the transaction information of the target transaction object within a preset time period, and the judgment result is obtained. The abnormality level is determined based on the judgment result.
[0005] Secondly, this application provides a real-time risk management system for data transactions, the system comprising: The acquisition module is used to acquire transaction information of the target transaction object within a preset time period. The transaction information includes multiple sub-information. The generation module is used to generate transaction features to be detected based on sub-information, obtain historical transaction features marked as normal, and apply random perturbation to each historical transaction feature to generate amplified features corresponding to each historical transaction feature. The judgment module is used to generate normal core features based on all historical transaction features and their corresponding amplified features, and to determine whether there is any risk in the transaction information of the target transaction object within a preset time period based on the normal core features and the transaction features to be detected, thereby obtaining the judgment result and determining the abnormality level based on the judgment result.
[0006] Thirdly, this application provides a real-time data transaction risk management device, the device comprising a memory and a processor. The memory stores a computer program; the processor executes the computer program to implement the steps of the aforementioned real-time data transaction risk management method.
[0007] Fourthly, this application provides a readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described real-time data transaction risk management method.
[0008] The beneficial effects of this invention are as follows: 1. This invention is based on normal historical transaction characteristics and amplified characteristics generated by random perturbations. It forms normal clusters through clustering and determines anomalies based on the distance between the transaction characteristics to be detected and each normal cluster. The entire process does not require manually setting fixed detection rules. Compared with detection methods with fixed rules, this invention can reduce the maintenance cost of the rule base and reduce the dependence on human experience.
[0009] 2. The clustering parameters of this invention, namely the density neighborhood radius and the density point threshold, are adaptively driven by the distribution statistics of normal feature data. As normal historical transaction features are gradually updated with business development, the clustering parameters can also be automatically recalculated and adjusted accordingly. This enables the detection method of this invention to continuously adapt to constantly changing attack patterns and overcomes the shortcomings of fixed rule methods in covering dynamic attacks.
[0010] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing embodiments of the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description
[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0012] Figure 1 This is a schematic diagram of the real-time data transaction risk management method described in this embodiment of the invention; Figure 2 This is a schematic diagram of the data transaction risk real-time management and control system structure described in this embodiment of the invention; Figure 3This is a schematic diagram of the data transaction risk real-time management device described in this embodiment of the invention. Detailed Implementation
[0013] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0014] It should be noted that similar reference numerals or letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0015] Example 1 like Figure 1 As shown in the figure, this embodiment provides a method for real-time management and control of data transaction risks, which includes steps S1, S2 and S3.
[0016] Step S1: Obtain the transaction information of the target transaction object within a preset time period. The transaction information includes multiple sub-information. In this step, transaction information can be understood as the collection of all transaction-related data generated by the target transaction object on the data trading platform within a preset time period. For example, transaction information may include sub-information in the following dimensions: Identification information: unique transaction identifier, target transaction object identifier, counterparty identifier, etc.; Time-related information: Transaction duration, etc.; Amount-related information: total transaction amount, average transaction amount, maximum transaction amount, minimum transaction amount, etc. Frequency and scale information: total number of transactions, transaction frequency per unit time, number of successful transactions, number of failed transactions, number of retries, etc.; Step S2: Generate the transaction features to be detected based on the sub-information, and obtain the historical transaction features marked as normal; apply random perturbation to each historical transaction feature to generate the amplified feature corresponding to each historical transaction feature; In this step, each sub-information in the transaction information is converted into a numerical representation, and then horizontally concatenated to obtain a one-dimensional feature row vector, which is the transaction feature to be detected. Specifically, the transaction information contains various types of sub-information. Some sub-information is already in numerical form (such as transaction duration and total transaction amount) and can be used directly; while some sub-information is in non-numerical form (such as a unique transaction identifier) and cannot be directly used in mathematical operations. Therefore, all sub-information needs to be uniformly converted into numerical representations. Numerical sub-information retains its original value; non-numerical sub-information is converted into its corresponding numerical value using a preset mapping rule, such as hash encoding. After this processing, the transaction feature to be detected is obtained. Historical transaction features are transaction features generated in past historical periods, also obtained by converting historical transaction information into numerical representations. In this step, the specific implementation steps for applying random perturbation to each historical transaction feature to generate the corresponding amplified feature include steps S21 and S22. Step S21: Execute the generation step: Generate a random noise vector with the same dimension as the historical transaction features. Each element in the random noise vector independently takes a value within a preset small fluctuation range [-δ, +δ]. Add the random noise vector to the historical transaction features element by element to obtain an amplified feature. Step S22: Repeat step K times to derive K amplified features from a historical transaction feature; where K is an integer greater than or equal to 2, and δ is a preset positive number.
[0017] In steps S21 and S22, δ can be 0.03 and K can be 5; sufficient historical transaction features can be amplified by using random perturbation. In this step, the K amplified features corresponding to each historical transaction feature can also be filtered. The specific steps include steps S23 and S24. Step S23: For each historical transaction feature: calculate the Euclidean distance between the historical transaction feature and each of its corresponding augmented features, denoted as the offset; calculate the minimum Euclidean distance between the historical transaction feature and all other historical transaction features, denoted as the normal interval; calculate the standard deviation of the Euclidean distance between the historical transaction feature and all other historical transaction features, denoted as the local dispersion. If the offset is less than or equal to the sum of the normal interval and the standard deviation, the augmented feature passes the first-level screening and proceeds to step S24; otherwise, the augmented feature is discarded directly. Step S24: Using the amplified feature as the center and the normal interval as the radius, count the number of historical transaction features contained within the radius. If the number is greater than or equal to 1, retain it; otherwise, discard it.
[0018] In the entire screening process described above, the first level of screening aims to limit the difference between the amplified feature and its corresponding historical transaction feature, ensuring that the offset of the amplified feature relative to the historical transaction feature does not exceed the normal interval plus local dispersion. The second level of screening requires that there be at least one historical transaction feature around the amplified feature, ensuring that the amplified feature falls within the distribution range of all historical transaction features, rather than being an isolated noise point. The entire screening process uses only the statistical values of the data itself as the standard, making the logic straightforward and easy to implement. Through these screening steps, amplified features that deviate too much from the normal distribution range can be removed, ensuring that the retained amplified features are reasonably close to their corresponding historical normal features and fall within the coverage range of all historical transaction features. This is beneficial for improving the effect of subsequent clustering, thereby enhancing the accuracy of anomaly detection.
[0019] Step S3: Generate normal core features based on all historical transaction features and their corresponding amplified features. Based on the normal core features and the transaction features to be detected, determine whether there is any risk in the transaction information of the target transaction object within a preset time period, obtain the judgment result, and determine the abnormality level based on the judgment result.
[0020] In this step, the specific implementation steps for generating normal core features based on all historical transaction features and their corresponding amplified features include steps S31 and S32. Step S31: Record all historical transaction features and their corresponding amplified features as normal features. Calculate the variance of all normal features in each dimension. Assign weights to each dimension according to the size of the variance. The larger the variance, the larger the weight. Multiply the value of each dimension with its corresponding weight to obtain the weighted normal features. Calculate the Euclidean distance between each pair of weighted normal features and use the median of all Euclidean distances as the benchmark distance. In this step, each dimension of the normal feature corresponds to a sub-information; Step S32: Calculate the density neighborhood radius and density point threshold based on the baseline distance. Iterate through each normal feature in turn and calculate the number of other normal features contained within the density neighborhood radius of the normal feature. If the number is greater than or equal to the density point threshold, mark the normal feature as a normal core feature. After the iteration is completed, all normal core features are obtained.
[0021] In this step, the specific implementation steps for calculating the density neighborhood radius and density point threshold based on the reference distance include step S321; Step S321: For each normal feature, count the number of other normal features contained within the baseline distance range of that normal feature, and record it as the original density; calculate the reciprocal of the average distance between each normal feature and its nearest N neighbors, and use it as the local density correction coefficient, where N is equal to the square root of the total number of normal features rounded down; multiply the original density of each normal feature by the local density correction coefficient to obtain the local density sensitivity value of each normal feature; calculate the mean of the original densities of all normal features to obtain the global average density; calculate the median of the local density sensitivity values of all normal features; divide the baseline distance by the ratio of the median to the global average density to obtain the density neighborhood radius; calculate the average of all local density sensitivity values, round down, and use it as the density point threshold. If the rounded value is less than a preset threshold, then the preset threshold is used as the density point threshold.
[0022] In this step, the density threshold can be, for example, 2 or 3. Furthermore, in steps S31, S32, and S321, the median of the weighted Euclidean distance is introduced as the baseline distance, and a local density sensitivity value is obtained by multiplying the local density correction coefficient by the original density, thereby adaptively determining the density neighborhood radius and the number of points threshold. This step allows the clustering parameters to be driven entirely by the distribution statistics (median, mean) of the normal features themselves, eliminating the need for manual parameter tuning.
[0023] In step S3, the specific implementation steps for determining whether there is a risk in the transaction information of the target transaction object within a preset time period based on the normal core features and the transaction features to be detected include steps S33 and S34. Step S33: Treat all normal core features as nodes. For any two nodes, if the Euclidean distance between the two nodes is less than or equal to the density neighborhood radius, then establish a connecting edge between the two nodes. After traversing all node pairs, an undirected graph consisting of nodes and connecting edges is obtained. Find all connected components in the undirected graph. All normal core features in each connected component constitute a core point group. In this step, all normal core features are initially treated as nodes in the graph. Then, any two nodes are examined one by one: if their Euclidean distance is less than or equal to the density neighborhood radius, an edge is drawn between them, indicating that they are close and belong to the same region. After traversing all node pairs, all nodes and edges together form an undirected graph. Next, in this undirected graph, connected components are searched, which are groups of nodes that are directly or indirectly connected to each other by edges, but not connected to other groups of nodes. Connected components can also be understood as interconnected clusters in the graph. All normal core features within each connected component constitute a core point group, representing an independent dense region. This step automatically groups core points that are close to each other into the same cluster, avoiding the complex iterative expansion process required by traditional density clustering and simplifying the clustering process.
[0024] Step S34: For each core point group, merge all normal core features within the core point group and all abnormal core features within the density neighborhood radius of each normal core feature to form a normal cluster; calculate the Euclidean distance from the transaction feature to be detected to each normal cluster. If the distance from the transaction feature to be detected to at least one normal cluster is less than or equal to the density neighborhood radius, the result is that the transaction feature to be detected is normal and there is no risk in the transaction information of the target transaction object within the preset time period. Otherwise, the result is that the transaction feature to be detected is abnormal and there is risk in the transaction information of the target transaction object within the preset time period.
[0025] In this step, abnormal core features are normal features that are not marked as normal core features; In step S3, the specific implementation steps for determining the anomaly level based on the judgment result include step S35; Step S35: Analyze the judgment result. When the judgment result is that the transaction feature to be detected is abnormal and the transaction information of the target transaction object within the preset time period is risky, calculate the shortest Euclidean distance from the transaction feature to be detected to all normal clusters, and record it as the minimum deviation distance; calculate the distance from all normal features in the normal cluster corresponding to the shortest Euclidean distance to the centroid of the cluster, and obtain the distance sequence; calculate the statistical indicators of the distance sequence, including the median, upper quartile and maximum value; determine the abnormality level based on the minimum deviation distance and the statistical indicators, and associate each level with preset risk control actions.
[0026] In this step, the specific implementation steps for determining the anomaly level based on the minimum deviation distance and statistical indicators include steps S351 and S352; Step S351: Compare the minimum deviation distance with the statistical indicators, and determine the anomaly level based on the comparison results. Specifically, if the minimum deviation distance is less than or equal to the median, the anomaly level is determined to be low; if the minimum deviation distance is greater than the median and less than or equal to the upper quartile, the anomaly level is determined to be medium; if the minimum deviation distance is greater than the upper quartile and less than or equal to the maximum value, the anomaly level is determined to be high; if the minimum deviation distance is greater than the maximum value, the anomaly level is determined to be very high. Step S352: Obtain the average distance between all normal features as the global average distance, and calculate the ratio of the minimum deviation distance to the global average distance as the global deviation factor; if the global deviation factor is greater than the preset global deviation factor threshold, then the abnormality level corresponding to the transaction feature to be detected is increased by one level.
[0027] In step S352, raising the level by one grade means the severity becomes more severe; for example, a high level becomes an extremely high level after being raised by one grade. Furthermore, steps S35, S351, and S352, based on the anomaly assessment, further refine the severity of the anomaly. By comparing the distance from the detected feature to the nearest normal cluster with the distance distribution within that cluster (median, upper quartile, maximum value), multiple risk levels, ranging from slight boundary deviation to complete isolation, can be distinguished. This allows for differentiated control actions based on different levels (such as logging only, increasing verification, blocking transactions, freezing accounts). Simultaneously, a global average distance is introduced as a calibration factor to calculate a global deviation factor, dynamically adjusting the anomaly level and avoiding distortion in the level evaluation caused by differences in the looseness of different normal clusters.
[0028] Example 2 like Figure 2 As shown in the figure, this embodiment provides a real-time data transaction risk management system, which includes an acquisition module 1, a generation module 2, and a judgment module 3.
[0029] Module 1 is used to acquire transaction information of the target transaction object within a preset time period. The transaction information includes multiple sub-information. Generation module 2 is used to generate transaction features to be detected based on sub-information, obtain historical transaction features marked as normal, and apply random perturbation to each historical transaction feature to generate amplified features corresponding to each historical transaction feature; The judgment module 3 is used to generate normal core features based on all historical transaction features and their corresponding amplified features, and to determine whether there is any risk in the transaction information of the target transaction object within a preset time period based on the normal core features and the transaction features to be detected, thereby obtaining the judgment result and determining the abnormality level based on the judgment result.
[0030] In one specific embodiment of this disclosure, the generation module 2 further includes a generation unit 21 and a repeating unit 22.
[0031] The generation unit 21 is used to perform the generation steps: generating a random noise vector with the same dimension as the historical transaction features, wherein each element of the random noise vector independently takes a value in a preset small fluctuation range [-δ, +δ]; and adding the random noise vector to the historical transaction features element by element to obtain an amplified feature. The repeating unit 22 is used to repeat the generation step K times to derive K amplified features from a historical transaction feature; where K is an integer greater than or equal to 2 and δ is a preset positive number.
[0032] In one specific embodiment of this disclosure, the determination module 3 further includes a calculation unit 31 and a traversal unit 32.
[0033] The calculation unit 31 is used to record all historical transaction features and their corresponding amplified features as normal features, calculate the variance of all normal features in each dimension, assign weights to each dimension according to the size of the variance, the larger the variance, the larger the weight; multiply the value of each dimension with its corresponding weight to obtain the weighted normal features; calculate the Euclidean distance between each pair of weighted normal features, and use the median of all Euclidean distances as the benchmark distance. Traversal unit 32 is used to calculate the density neighborhood radius and density point threshold based on the reference distance. It traverses each normal feature in turn and calculates the number of other normal features contained in the density neighborhood radius of the normal feature. If the number is greater than or equal to the density point threshold, the normal feature is marked as a normal core feature. After the traversal is completed, all normal core features are obtained.
[0034] In one specific embodiment of this disclosure, the traversal unit 32 further includes a statistics unit 321.
[0035] The statistical unit 321 is used to count the number of other normal features contained within the baseline distance range of each normal feature, denoted as the original density; calculate the reciprocal of the mean distance between each normal feature and its N nearest neighbors, as the local density correction coefficient, where N is equal to the square root of the total number of normal features rounded down; multiply the original density of each normal feature by the local density correction coefficient to obtain the local density sensitivity value of each normal feature; calculate the mean of the original densities of all normal features to obtain the global average density; calculate the median of the local density sensitivity values of all normal features; divide the baseline distance by the ratio of the median to the global average density to obtain the density neighborhood radius; calculate the average of all local density sensitivity values, round down, and use it as the density point threshold. If the rounded value is less than a preset threshold, the preset threshold is used as the density point threshold.
[0036] In one specific embodiment of this disclosure, the determination module 3 further includes an establishment unit 33 and a determination unit 34.
[0037] Unit 33 is established to treat all normal core features as nodes. For any two nodes, if the Euclidean distance between the two nodes is less than or equal to the density neighborhood radius, a connecting edge is established between the two nodes. After traversing all node pairs, an undirected graph consisting of nodes and connecting edges is obtained. All connected components in the undirected graph are found, and all normal core features in each connected component constitute a core point group. The judgment unit 34 is used to merge all normal core features within each core point group and all abnormal core features within the density neighborhood radius of each normal core feature to form a normal cluster; calculate the Euclidean distance from the transaction feature to be detected to each normal cluster. If the distance from the transaction feature to be detected to at least one normal cluster is less than or equal to the density neighborhood radius, the judgment result is that the transaction feature to be detected is normal and there is no risk in the transaction information of the target transaction object within the preset time period. Otherwise, the judgment result is that the transaction feature to be detected is abnormal and there is risk in the transaction information of the target transaction object within the preset time period.
[0038] It should be noted that the specific methods by which each module performs operations in the system described in the above embodiments have been described in detail in the embodiments related to the method, and will not be elaborated here.
[0039] Example 3 Corresponding to the above method embodiments, this disclosure also provides a real-time data transaction risk management device. The real-time data transaction risk management device described below and the real-time data transaction risk management method described above can be referred to each other.
[0040] Figure 3 This is a block diagram illustrating a real-time data transaction risk management device 300 according to an exemplary embodiment. (See diagram below.) Figure 3 As shown, the real-time data transaction risk management device 300 may include: a processor 301 and a memory 302. The real-time data transaction risk management device 300 may also include one or more of the following: a multimedia component 303, an I / O interface 304, and a communication component 305.
[0041] The processor 301 controls the overall operation of the real-time data transaction risk management device 300 to complete all or part of the steps in the aforementioned real-time data transaction risk management method. The memory 302 stores various types of data to support the operation of the real-time data transaction risk management device 300. This data may include, for example, instructions for any application or method operating on the device, as well as application-related data such as contact data, sent and received messages, images, audio, video, etc. The memory 302 can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The multimedia component 303 may include a screen and an audio component. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in the memory 302 or transmitted via the communication component 305. The audio component also includes at least one speaker for outputting audio signals. I / O interface 304 provides an interface between processor 301 and other interface modules, such as keyboards, mice, and buttons. These buttons can be virtual or physical. Communication component 305 is used for wired or wireless communication between the data transaction risk real-time management device 300 and other devices. Wireless communication includes Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, or 4G, or a combination thereof. Therefore, the corresponding communication component 305 may include a Wi-Fi module, a Bluetooth module, and an NFC module.
[0042] In an exemplary embodiment, the real-time data transaction risk management device 300 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the aforementioned real-time data transaction risk management method.
[0043] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided. When executed by a processor, these program instructions implement the steps of the aforementioned real-time data transaction risk management method. For example, the computer-readable storage medium may be the aforementioned memory 302 including program instructions, which may be executed by the processor 301 of the real-time data transaction risk management device 300 to complete the aforementioned real-time data transaction risk management method.
[0044] Example 4 Corresponding to the above method embodiments, this disclosure also provides a readable storage medium. The readable storage medium described below can be referred to in conjunction with the data transaction risk real-time management method described above.
[0045] A readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of the real-time data transaction risk management method described in the above method embodiments are implemented.
[0046] Specifically, the readable storage medium can be a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other readable storage medium capable of storing program code.
[0047] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for real-time risk management of data transactions, characterized in that, include: Obtain transaction information of the target transaction object within a preset time period. The transaction information includes multiple sub-information. Generate transaction features to be detected based on sub-information, and obtain historical transaction features marked as normal; Apply random perturbation to each historical transaction feature to generate the corresponding augmented feature; Normal core features are generated based on all historical transaction features and their corresponding amplified features. Based on the normal core features and the transaction features to be detected, it is determined whether there is any risk in the transaction information of the target transaction object within a preset time period, and the judgment result is obtained. The abnormality level is determined based on the judgment result.
2. The method for real-time risk management of data transactions according to claim 1, characterized in that, Apply random perturbations to each historical transaction feature to generate augmented features corresponding to each historical transaction feature, including: The generation steps are as follows: Generate a random noise vector with the same dimensions as the historical transaction features. Each element in the random noise vector independently takes a value within a preset small fluctuation range [-δ, +δ]. Add the random noise vector to the historical transaction features element by element to obtain an amplified feature. Repeat the generation step K times to derive K amplified features from a historical transaction feature; where K is an integer greater than or equal to 2, and δ is a preset positive number.
3. The method for real-time risk management of data transactions according to claim 1, characterized in that, Normal core features are generated based on all historical transaction characteristics and their corresponding amplified features, including: All historical transaction features and their corresponding amplified features are denoted as normal features. The variance of all normal features in each dimension is calculated, and the weight of each dimension is assigned according to the size of the variance, with a larger variance resulting in a larger weight. The value of each dimension is multiplied by its corresponding weight to obtain the weighted normal features. The Euclidean distance between each pair of weighted normal features is calculated, and the median of all Euclidean distances is used as the baseline distance. Based on the baseline distance, the density neighborhood radius and density point threshold are calculated. Each normal feature is traversed sequentially, and the number of other normal features contained within the density neighborhood radius of the normal feature is calculated. If the number is greater than or equal to the density point threshold, the normal feature is marked as a normal core feature. After the traversal is completed, all normal core features are obtained.
4. The method for real-time risk management of data transactions according to claim 3, characterized in that, The density neighborhood radius and density point threshold are calculated based on the baseline distance, including: For each normal feature, count the number of other normal features contained within the baseline distance range of that normal feature, and denote it as the original density; calculate the reciprocal of the mean distance between each normal feature and its N nearest neighbors, and use it as the local density correction coefficient, where N is equal to the square root of the total number of normal features rounded down; multiply the original density of each normal feature by the local density correction coefficient to obtain the local density sensitivity value of each normal feature; calculate the mean of the original densities of all normal features to obtain the global average density; calculate the median of the local density sensitivity values of all normal features; divide the baseline distance by the ratio of the median to the global average density to obtain the density neighborhood radius; calculate the average of all local density sensitivity values, round down, and use it as the density point threshold. If the rounded value is less than a preset threshold, then the preset threshold is used as the density point threshold.
5. The method for real-time risk management of data transactions according to claim 4, characterized in that, Based on normal core features and the features of the transaction to be detected, the risk of the target transaction object's transaction information within a preset time period is determined, and the determination result is obtained, including: Treat all normal core features as nodes. For any two nodes, if the Euclidean distance between them is less than or equal to the density neighborhood radius, then establish a connecting edge between them. After traversing all node pairs, an undirected graph consisting of nodes and connecting edges is obtained. Find all connected components in the undirected graph. All normal core features in each connected component constitute a core point group. For each core point cluster, all normal core features within the core point cluster and all abnormal core features located within the density neighborhood radius of each normal core feature are merged to form a normal cluster. The Euclidean distance from the transaction feature to be detected to each normal cluster is calculated. If the distance from the transaction feature to be detected to at least one normal cluster is less than or equal to the density neighborhood radius, the result is that the transaction feature to be detected is normal and there is no risk in the transaction information of the target transaction object within the preset time period. Otherwise, the result is that the transaction feature to be detected is abnormal and there is risk in the transaction information of the target transaction object within the preset time period.
6. A real-time risk management system for data transactions, characterized in that, include: The acquisition module is used to acquire transaction information of the target transaction object within a preset time period. The transaction information includes multiple sub-information. The generation module is used to generate transaction features to be detected based on sub-information, obtain historical transaction features marked as normal, and apply random perturbation to each historical transaction feature to generate amplified features corresponding to each historical transaction feature. The judgment module is used to generate normal core features based on all historical transaction features and their corresponding amplified features, and to determine whether there is any risk in the transaction information of the target transaction object within a preset time period based on the normal core features and the transaction features to be detected, thereby obtaining the judgment result and determining the abnormality level based on the judgment result.
7. The real-time data transaction risk management system according to claim 6, characterized in that, The generation module includes: The generation unit is used to perform the generation steps: generating a random noise vector with the same dimension as the historical transaction features, wherein each element of the random noise vector independently takes a value in a preset small fluctuation range [-δ, +δ]; and adding the random noise vector to the historical transaction features element by element to obtain an amplified feature. The repeating unit is used to repeat the generation step K times, deriving K amplified features from a historical transaction feature; where K is an integer greater than or equal to 2, and δ is a preset positive number.
8. The real-time data transaction risk management system according to claim 6, characterized in that, The determination module includes: The calculation unit is used to record all historical transaction features and their corresponding amplified features as normal features, calculate the variance of all normal features in each dimension, assign weights to each dimension according to the size of the variance, with larger variances resulting in larger weights; multiply the value of each dimension by its corresponding weight to obtain weighted normal features; calculate the Euclidean distance between each pair of weighted normal features, and use the median of all Euclidean distances as the baseline distance. The traversal unit is used to calculate the density neighborhood radius and density point threshold based on the baseline distance. It traverses each normal feature in turn and calculates the number of other normal features contained within the density neighborhood radius of the normal feature. If the number is greater than or equal to the density point threshold, the normal feature is marked as a normal core feature. After the traversal is completed, all normal core features are obtained.
9. The real-time data transaction risk management system according to claim 8, characterized in that, Traversing units, including: The statistical unit is used to count the number of other normal features contained within the baseline distance range of each normal feature, denoted as the original density; calculate the reciprocal of the mean distance between each normal feature and its N nearest neighbors, as the local density correction coefficient, where N is equal to the square root of the total number of normal features rounded down; multiply the original density of each normal feature by the local density correction coefficient to obtain the local density sensitivity value of each normal feature; calculate the mean of the original densities of all normal features to obtain the global average density; calculate the median of the local density sensitivity values of all normal features; divide the baseline distance by the ratio of the median to the global average density to obtain the density neighborhood radius; calculate the average of all local density sensitivity values, round down, and use the result as the density point threshold. If the result after rounding down is less than a preset threshold, the preset threshold is used as the density point threshold.
10. The real-time data transaction risk management system according to claim 9, characterized in that, The determination module includes: Establish a unit to treat all normal core features as nodes. For any two nodes, if the Euclidean distance between the two nodes is less than or equal to the density neighborhood radius, then establish a connecting edge between the two nodes. After traversing all node pairs, an undirected graph consisting of nodes and connecting edges is obtained. Find all connected components in the undirected graph, and all normal core features in each connected component constitute a core point group. The judgment unit is used to merge all normal core features within each core point group and all abnormal core features within the density neighborhood radius of each normal core feature to form a normal cluster. It calculates the Euclidean distance from the transaction feature to be detected to each normal cluster. If the distance from the transaction feature to be detected to at least one normal cluster is less than or equal to the density neighborhood radius, the judgment result is that the transaction feature to be detected is normal and there is no risk in the transaction information of the target transaction object within the preset time period. Otherwise, the judgment result is that the transaction feature to be detected is abnormal and there is risk in the transaction information of the target transaction object within the preset time period.